Is there any information as to what they violated that is resulting in the fine? This article is particularly sparse on details.
Press release: https://www.dataprotection.ie/en/news-media/data-protection-...
The main thing is that WhatsApp changed some processing from relying on Consent to relying on "Contractual Agreement" (contrary to popular opinion, GDPR does not always require consent). The fine is based on two things: 1) this change and its ramifications were not communicated to users 2) you can't actually use "Contractual Agreement" for some of that processing.
1) is important because consent can be withdrawn. If users still believe that processing is based on their consent, they believe they have the ability to withdraw consent and processing must stop, but that doesn't apply to Contractual Agreement. In other words, this lack-of-clarity means users believed they had more control over they data, but they didn't.
2) requires reading deeper into the decision to see what matters. From background, Facebook has argued in the past that personalized advertising is a contractually-provided service, and that's probably what got rejected.
The cookie law is quite well written and makes it clear that the obvious dark patterns are verboten. You aren't allowed to use intentionally deceptive toggles, or to make it much harder to say no than to say yes. The law is very rarely enforced though, so such dark patterns are rife.
I suspect something similar may happen with other Internet-governing regulation.
What got rejected is using the data for "service improvement" and "security" - in particular how WhatsApp used personal data for these purposes, and how in the opinion of Europea data protection authorities this was not necessary for Meta to perform the contract.